If the size of the supplied buffer in FileHandleReadLine(), module UefiFileHandleLib.c, was not 0, but was not enough to fit in the line, the size is increased, and then the Buffer of the new size is zeroed. This size is always larger than the supplied buffer size, causing supplied buffer overrun. Fix the issue by using the supplied buffer size in ZeroMem().
Signed-off-by: Vladimir Olovyannikov <vladimir.olovyanni...@broadcom.com> Cc: Michael D Kinney <michael.d.kin...@intel.com> Cc: Liming Gao <liming....@intel.com> --- MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c b/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c index 28e28e5f67d5..4bc9fabb6c74 100644 --- a/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c +++ b/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c @@ -1039,10 +1039,13 @@ FileHandleReadLine( // if we ran out of space tell when... // if ((CountSoFar+1-CrCount)*sizeof(CHAR16) > *Size){ + UINTN OldSize; + + OldSize = *Size; *Size = (CountSoFar+1-CrCount)*sizeof(CHAR16); if (!Truncate) { - if (Buffer != NULL && *Size != 0) { - ZeroMem(Buffer, *Size); + if (Buffer != NULL && OldSize != 0) { + ZeroMem(Buffer, OldSize); } FileHandleSetPosition(Handle, OriginalFilePosition); return (EFI_BUFFER_TOO_SMALL); -- 2.26.2.266.ge870325ee8 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#60736): https://edk2.groups.io/g/devel/message/60736 Mute This Topic: https://groups.io/mt/74683735/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-